Security

int2t05 Bundle

Use when restructuring code without changing behavior — extract modules, move classes, redraw dependency boundaries, split or merge files. Behavior-preserving structural changes that make the codebase easier to evolve, distinct from single-file clarity cleanup. Triggers on "refactor structure", "extract module", "move class", "split file", "change dependency", "重构结构", "提取模块", "拆分文件", "改依赖图". Not for single-file clarity cleanup (use simplify), architecture audit producing a design doc (use codebase-design), or lint/style fixes (use linting).

igmarin Bundle

Loads the Hanami application context before any code, spec, or review work — discovers slices, providers, settings, routes, ROM setup, test framework, DI conventions, and existing patterns, with a mandatory security gate to redact all passwords/credentials/tokens/API keys before note-taking, and a rule to never propose code without first running load-context. The non-negotiable first step for every Hanami task. Trigger words: load context, before I code, what does this app use, match existing style, load-context, show me the app, discover structure, context.

igmarin Skill

Use when reviewing Hanami 2.x code for quality and convention adherence — check Action responsibility at ≤~10 lines delegating business logic, verify DI via `include Deps[]` with no `Hanami.app["key"]` direct access, audit query locations ensuring all DB queries live in Repositories/Relations, inspect Repositories returning Entities not raw hashes, review Views receiving pre-fetched data only, check error handling logging+generic messages without exposing e.message, and assess test coverage for 400/404/422/500 paths. Triggers on phrases like 'review my Hanami code', 'check my action', 'code review', or 'dry-rb patterns'.

igmarin Skill

Reviews Hanami slice boundaries for violations — cross-slice coupling, shared internals, import leaks, provider leaks where a provider registers something that should be slice-scoped, and boundary design — producing findings with severity and concrete recommendations, every finding citing the specific file and line as evidence. Use when auditing slice architecture or preparing for extraction. Trigger words: review slice, slice boundaries, slice coupling, cross-slice, boundary review, slice audit, architecture review, bounded context.

kriscard Bundle

Bug-first, evidence-only review for code changes: find production-impacting security, correctness, reliability, performance, and maintainability issues. Use after writing or modifying code, when reviewing diffs or PRs, or when the user asks "review this", "check this code", mentions security, code quality, or performance. Enforces project guidance when available and prefers silence over speculative findings.

kriscard Bundle

Dotfiles health baseline and triage. Use when the user wants a whole-system audit of ~/.dotfiles: credential leaks, shell startup, Stow symlinks, Neovim startup, missing tools, or orphan config. Do not use for targeted Neovim or shell edits; route those to neovim or shell-env.

kriscard Bundle

Neovim config healthcheck for ~/.dotfiles/.config/nvim/ using lazy.nvim and GNU Stow. Use when the user wants to validate or repair Neovim, add/remove plugins, diagnose startup performance, fix keymaps/LSP, or modernize config. Prefer audit for whole-dotfiles reviews and shell-env for non-Neovim terminal config.

kriscard Bundle

Stow-first shell environment editing for zsh, aliases, tmux/sesh, Starship, Ghostty, yabai, Git, and dotfiles packages. Use when the user wants to add or change terminal config, aliases, shell startup, or Stow-managed symlinks. Route Neovim-specific work to neovim and whole-system health checks to audit.

kriscard Bundle

Read-only PARA classification audit for the Obsidian vault, followed by an optional explicit-fix flow. Use when the user asks to audit PARA, check whether notes are in the right place, find projects missing outcomes/deadlines, or runs /audit-para.

lost-rob0t Bundle

audit, over-engineering, yagni, deletion, simplification

luckyrjain Bundle

Use for a dedicated security review: authentication, authorization, secrets handling, injection, SSRF, tenant isolation, data leakage, cryptography, and dependency exposure. Keywords: security review, authN, authZ, injection, SSRF, tenant isolation, secrets, cryptography review. Not for a general code-quality MR review (pr-review, which escalates here for security-sensitive findings), or a dependency-upgrade CVE sweep (dependency-upgrade-review).

takemo101 Skill

セキュリティ設計書および実装コードを専門的にレビューするセキュリティスペシャリスト

xpert-ai Bundle

Interact with Lark/Feishu Open Platform using the official CLI tool. Use this skill when the user wants to manage calendar events, send messages, work with documents, manage spreadsheets, handle tasks, or interact with any Lark/Feishu business domain. Supports both user-level (OAuth) and bot-level (App ID/Secret) authentication.

code-saurabh Skill

Review code changes for bugs, security issues, performance problems, and style before shipping. Use when the user asks for a code review, wants to check a diff or PR, needs a second opinion on implementation, or says "review this", "check this code", or "is this safe to ship".

code-saurabh Skill

Developer experience audit and improvement skill. Use when the user wants to review their API, CLI, SDK, or docs from a developer perspective, benchmark their onboarding flow against competitors, measure Time to Hello World (TTHW), trace friction points step-by-step, or improve the developer experience of a product before launch.

code-saurabh Skill

Build, review, debug, and maintain production Java applications, libraries, services, and APIs. Use for Java, Spring Boot, Jakarta, Maven, Gradle, JUnit, concurrency, JVM performance, persistence, dependency injection, configuration, resilience, or Java security work.

code-saurabh Bundle

Expert application and infrastructure security guidance. Use when the user asks about OWASP Top 10, JWT review, RBAC, OAuth, threat modeling, SSRF, CSRF, XSS, or secret management.

aborroy Skill

Generate a custom Alfresco audit application (audit XML + data extractors/generators + enable properties) and optional query Web Script. In-Process SDK (Maven) only.

agent-packs Skill

Design and implement GraphQL APIs with correct schema design, resolver patterns, N+1 prevention, federation, and security. Use when building or evolving a GraphQL layer.

agent-packs Skill

Review and harden code for auth, secrets, dependencies, input boundaries, and common application security risks.

agent-packs Skill

Review code across correctness, maintainability, tests, security, and user-visible behavior. Use before merge or when assessing a change.

agent-packs Skill

Apply adversarial review to important implementation decisions before they become expensive mistakes. Use for production, security, or unfamiliar changes.

agent-packs Skill

Run evidence-based engineering leadership reviews across strategy, portfolio and capacity, delivery, quality, architecture, launch readiness, security risk, AI-assisted engineering adoption, organizational health, and follow-through.

claude-world Skill

Capture frames or short clips from RTSP/ONVIF network cameras or local webcams using ffmpeg or camsnap. Use when user says "take a snapshot from camera", "capture front door", "grab a frame from the security cam", or any camera capture request involving IP cameras or webcams.

claude-world Skill

Audit host security using built-in system tools (netstat, lsof, ss, ufw, systemctl, ps, who, last). Check open ports, running services, listening processes, firewall rules, and recent logins. No external CLI needed. Use when user says "security audit", "check open ports", "harden server", or "what's listening on my machine".

binfen1 Skill

Live developer experience audit. Uses the browse tool to actually TEST the developer experience: navigates docs, tries the getting started flow, times TTHW, screenshots error messages, evaluates CLI help text. Produces a DX scorecard with evidence. Compares against /plan-devex-review scores if they exist (the boomerang: plan said 3 minutes, reality says 8). Use when asked to "test the DX", "DX audit", "developer experience test", or "try the onboarding". Proactively suggest after shipping a developer-facing feature. (gstack)

binfen1 Bundle

Designer's eye QA: finds visual inconsistency, spacing issues, hierarchy problems, AI slop patterns, and slow interactions — then fixes them. Iteratively fixes issues in source code, committing each fix atomically and re-verifying with before/after screenshots. For plan-mode design review (before implementation), use /plan-design-review. Use when asked to "audit the design", "visual QA", "check if it looks good", or "design polish". Proactively suggest when the user mentions visual inconsistencies or wants to polish the look of a live site. (gstack)

binfen1 Bundle

Interactive developer experience plan review. Explores developer personas, benchmarks against competitors, designs magical moments, and traces friction points before scoring. Three modes: DX EXPANSION (competitive advantage), DX POLISH (bulletproof every touchpoint), DX TRIAGE (critical gaps only). Use when asked to "DX review", "developer experience audit", "devex review", or "API design review". Proactively suggest when the user has a plan for developer-facing products (APIs, CLIs, SDKs, libraries, platforms, docs). (gstack)

bage2014 Skill

系统安全规范

igmarin Skill

Pre-PR quality loop with hard gates: mix format, credo, dialyzer, hex.audit, full tests → optional FCIS-safe refactor with characterization tests and HITL → docs/specs on public APIs. Trigger: before PR, quality sweep, production readiness, credo, dialyzer, refactor for PR.

igmarin Bundle

Reviews Elixir/Phoenix pull requests, diffs, and merge requests for quality, security, and conventions. Use when asked to do a PR review, review my diff, review my merge request, or code review of Elixir/Phoenix/BEAM code. Grounds every finding in a real file:line from the actual diff, applies exactly three severity labels (Critical, Suggestion, Nice to have) where Critical covers security/data loss/crash and Always Critical flags (Repo calls in LiveViews, String.to_atom on user input, unparameterized Ecto queries, missing @impl true, missing connected? guard, ! functions in application logic, raise for expected errors, business rules inside handle_event/3 or perform/1). Includes a task-list handoff line and follows the principle: review early, review often; self-review before PR; re-review after significant changes. Trigger words: code review, PR review, review my code, review PR, pull request review, review diff, review before merge, code audit.

hungrykelvin123 Bundle

Roblox engineering workflow router with direct phases, evidence-first design, security, performance, review, and verification discipline. Invoke explicitly with $david-mode.

hungrykelvin123 Bundle

Review or design Roblox remotes, server authority, purchases, rewards, RNG, persistence, and anti-abuse behavior.

hungrykelvin123 Bundle

Audit and update a project-local Roblox verification skill when code, Rojo mappings, tests, remotes, data schemas, or authored contracts change.

archive228 Skill

Catch hardcoded secrets, keys, and tokens before they get committed. Use before any commit and on any file with credentials.

archive228 Skill

Security-review a diff against the OWASP Top 10. Use before merging anything that touches auth, input handling, queries, or external calls.